VYPR
← All advisories
Critical severity9.8CISA KEVNVD Advisory· Published Jan 16, 2024· Updated Jun 17, 2026

CVE-2023-22527

CVE-2023-22527

Description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Atlassian/Confluence Data Center4 versions
    cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*range: >=8.0.0,<8.5.4
    • cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*
    • (no CPE)range: <latest supported versions
    • (no CPE)range: >= 8.0.0
  • Atlassian/Confluence2 versions
    cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*range: >=8.0.0,<8.5.4
    • (no CPE)range: >= 8.0.0

Patches

Vulnerability mechanics

References

5

News mentions

1